Advisory Catalog

lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard

lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks

lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function

lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses

vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbitrary tp_size values in prefill/decode disaggregated deployments to exhaust memory and trigger kernel

vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing valid requests to be delayed by up to 480

vllm p2p never connected zmq_exhaustion

vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. Attackers can trigger an assertion failure in NixlBas

vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomplete kv_transfer_params dictionary entries to trigger an uncaught KeyError in EngineCore scheduling, c

Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)

Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid until

When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the a

Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holding asset-read access could therefore enumerate asset events — including the source Dag ID, task ID, r

vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). Attackers can supply out-of-bounds token indices that corrupt logits memory of concurrent requests, causing different in-flight HTTP requests

vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs index the penalty prompt-presence bitset without bounds checking against vocabulary size. Attackers can submit multimodal audio requests with tokens equal to vocabulary size, causing

vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in SamplingParams._validate_allowed_token_ids(). Attackers can supply token IDs above the output vocabulary that pass validation, causing LogitBiasState to corrupt GPU logits state and allow

Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

AnyIO process-pool workers can block indefinitely on undrained stderr

AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups

LMDeploy has an SSRF bypass

LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading

LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs. A single request with a negative token ID triggers a CUDA device-side assertion that poison

OpenCVE: Server-Side Request Forgery (SSRF) in notifications

virtualenv bash and fish activation scripts execute commands embedded in paths

virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

virtualenv: Command injection via --prompt in activate.bat (batch activator)

vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers can submit requests with max_tokens=0 to exhaust decode-worker memory without bound until the worker restarts.

djust: A template binding inherits a context safety grant it never earned (XSS)

djust: Six template-layer defects emit attacker-controlled markup unescaped (XSS)

Jupyter Server: 5xx request logging leaks token-bearing Referer header values

virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns

Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)

sanic chunked trailer request smuggling allows hidden second request execution